Lecture 17
CS 1813 – Discrete Mathematics
How Does It Work
in the Real World?
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
1
What Are We Doing Here?
And Where are We Going, Anyway?
 What does “software correctness” mean?
 It’s correct if it has the properties the designers intended
 Intended properties must be formulated
 Logical reasoning helps ensure that properties are satisfied
 How can correct software be constructed?
 Writing down intended properties helps
 Good first step towards ensuring correctness
 Encourages thinking about what is needed
 Reasoning is efficient debugging
 Program review, logical analysis, proof of correctness
 Ten times faster than test-and-debug (reference: Watts Humphrey)
 How can studying discrete math help?
 Tools for specifying software properties
 Mental processes of logical inference
 Viewing software correctness as a controllable engineering factor
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
2
What Software?
Is Any of This Stuff Software?
Programs Examined So Far











sum
and
or
length
++
concat
maximum
shuffle
deal
msort
qsort
Computation Patterns
 foldr
 map
 zipWith
This Is Real Software
Significant software modules
Components of larger systems
Important properties verified
Full specs are an attainable goal
Non-trivial software
Non-trivial reasoning
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
3
Maybe It’s Real, But It’s Weird
What About Regular Software?
 OK, consider the Russian peasant’s algorithm
8 `div` 3 = 2
rp :: Integer -> Integer -> Integer
Quotient in 3rd grd arith
rp b e = if e == 0 then 1
else if (evenNumber e) then (rp (b*b) (e `div` 2))
else b*(rp (b*b) (e `div` 2))
Still weird, but be patient … we’re getting there
Theorem (RPexp). b  0, e  0 |– (rp b e) = be
Note:
There’s a similar algorithm for multiplication
That’s the one the peasants were using
Proof (strong induction on e)
Base case: e = 0
rp b 0
=1
= b0
(rp).0
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
9th grade algebra
4
Inductive Cases — Russian Peasant Proof
rp :: Integer -> Integer -> Integer
rp b e = if e == 0 then 1
else if (evenNumber e) then (rp (b*b) (e `div` 2))
else b*(rp (b*b) (e `div` 2))
Inductive case, even exponent: e = 2*n  0
rp b e
= rp b (2*n)
= rp (b*b) ((2*n) `div` 2)
= rp (b*b) n
= (b*b)n
= (b2)n
= b2n
= be
e = 2*n equation
(rp).even
2nd grade arithmetic
induction hypothesis (n < e)
9th grade algebra
9th grade algebra
e = 2*n equation
Inductive case, odd exponent: e = 2*n + 1
similar
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
5
Russian Peasant — as a looping program
Function precondition: b  0  e  0
Proof
integer rph(integer b, integer e)
e
b
integer r, a, n
n
=
a
a = b, n = e
a=b
n
=1a
mult id
n=e
n
=ra
r=1
r=1
e
Loop precondition: b =ran  n0
Proof (odd case)
while (n  0)
e
b
if (oddNumber n) r = r*a
current state
= r  an
ind hyp
a
=
a*a
r=r
= r  a2k+1
n odd
n
=
n
div
2
a=a
e
n
= r  a  (a2)k
9th grd alg
Invariant:
b
=ra

n0
n=n
= r  (a2)k
r=ra
return r be = ran  n0  (n0)
= r  an
a = a2, n=k
e
Loop Induction
r=b
 Prove: P(x1, x2, … xx) is true when a loop begins
 Prove: P(x1, x2, … xx) is true at the end of each iteration
Induction hypothesis: assume P(x1, x2, … xx) true in previous iterations
 Conclude: P(x1, x2, … xx)  B(x1, x2, … xx) if & when loop terminates
B(x1, x2, … xx) is the loop continuation condition
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
6
Iteration
another pattern of computation
 until :: (a -> Bool) -> (a -> a) -> a -> a
 until done next start =
if (done start) then start
else (until done next (next start))
 “until” specifies the following pattern of computation
next(next(next( … (next(next start)) …)))
 Another notation for formulas like this
nextn start
— n is the number of nexts in the pattern
— n iterations of the function “next”
 The “until” pattern computes the nth iterate of “next”
 until done next start = nextn start
 n is the first natural number with done(nextn start) = True
 Theorem: P(start), (x.(P(x)  P(next x))) |– n.P(nextn start)
 Inductive case: n.(P(nextn start)  P(nextn+1 start))
 P(nextn start)  P(nextn+1 start)
 True because P(x)  P(next x)
with x = (nextn start), so P(next x) = P(next(nextn start))
observing that P(next(nextn start)) = P(nextn+1 start)
 Base case: P(next0 start) is True because (next0 start) = start
 Therefore, by induction, n.P(nextn start)
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
7
Russian Peasant Iterator
 Russian peasant “next” function
 nextRp(r, (b, e)) =
if (oddNumber e) then (r*b, (b*b, e `div` 2))
else (r, (b*b, e `div` 2))
 Invariant: P(a, (x, y))  a*xy = be
 Inductive case:
 (x, (y, z)).((x*yz = be)  (u*vw = be))
where (u, (v, w)) = nextRp(x, (y,z))
– Odd case, z = 2k+1: x*y2k+1 = (x*y) * (y2)k = u * vk
where (u, (v, k)) = nextRp(x, (y, 2k+1))
– Even case, z = 2k: : x*y2k = x * (y2)k = u * vk
where (u, (v, k)) = nextRp(x, (y, 2k))
 Base case: P((1, (b, e))) is True because 1*be = be
 Conclude n. P(nextRpn (1, (b, e)) ) is True
 Because P is invariant and the base case is True
 Russian peasant “done” function
 doneRp(r, (b, e)) = e == 0
 Technicality: nextRp(r, (b, 0)) = (r, (b, 0))
 Otherwise, nextRp fails to preserve property P after e reaches zero
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
8
Russian Peasant - the final word
 rpIteration b e = fst(until doneRp nextRp (1, (b, e)))
 fst(x, y) = x
 until d f s = if (d s) s else (until d f (f s))
{select 1st component}
{“until” iteration}
 (rpIteration b e) terminates  (rpIteration b e) = be
 (rpIteration b e) terminates 
n. until doneRp nextRp (1, (b, e))) = nextRpn(1, (b, e))








{only way “until” can stop}
doneRP(nextRpn(1, (b, e))) = True
{only way “until” can stop}
z = 0, where (x, (y, z)) = nextRpn(1, (b, e)) {only way “doneRP” true}
P(nextRpn(1, (b, e))) is True
{theorem proved earlier}
x*yz = be
{def’n P}
be = x*yz = x*y0 = x*1 = x
{since z = 0 and y0 = 1}
fst(x, (y, z)) = x
{def’n fst}
fst(nextRpn(1, (b, e))) = fst(x, (y, z)) = x
{def’n (x, (y,z))}
rpIteration b e = x = be
{def’n rpIteration, be = x}
 Termination
 Prove by strong induction on e in the formula (rpIteration b e)
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
9
End of Lecture
CS 1813 Discrete Mathematics, Univ Oklahoma
Copyright © 2000 by Rex Page
10